Development Overhead Average time to write, test, and deploy a
5
Mo' Detections, Mo' Problems
6
No Support for Common Patterns
7
Components
8
Detection and Alert Abstraction
9
Config Inheritance
10
Modular Pre/Post Processing
11
Manual Tuning Lifecycle
12
Self-Tuning Alerts
13
Repetitive Investigations... What Happens?
14
Automated Investigation Templates
15
Automated Containment
16
Detection Testing
17
Detection Functional Tests
18
Databricks Stacks!
19
Deploy/Reconfigure Jobs with Single PR
20
Problem #1 - Cyclical Investigations
21
Problem #3 - Finding Patterns
22
Solution: Document Recommendations
23
Automated Suggestions
24
Anatomy of an Alert
25
Entity Tokenization and Enrichment
26
Suggestion Algorithm WHY CANTI
Description:
Explore advanced security threat detection techniques using Apache Spark and Databricks in this 24-minute conference talk. Learn about Apple's innovative solutions for addressing scale complications, including notebook-based testing CI, self-tuning alerts, automated investigations, and DetectionKit. Discover how to reduce testing time, amplify signal from noise, automate incident containment, and formalize job configuration and testing. Gain insights into modular pre/post processor transform functions and stream-compatible exclusion mechanisms using foreach Batch. Understand the challenges of cyclical investigations, pattern finding, and the importance of document recommendations and automated suggestions in security threat detection.
Scaling Security Threat Detection with Apache Spark and Databricks